Your words belong to you.

Pagefond is operated by TechFusion Lab for readers aged 13 and over, subject to local requirements and store age ratings. Contact contact.techfusionlab@gmail.com about access, correction or deletion. Updated 15 October 2026.

Your library and account

Books, passages, page photographs, notes, bookmarks, recall cards and artwork are saved on your device. Printed-text recognition runs on-device. Account-free capture does not send the page to an AI service. If you choose cloud sync, your email and Firebase user ID identify an account containing the records you sync. Firebase Authentication handles sign-in, Firestore stores library records, and private Vercel Blob storage holds synced photographs and artwork.

Google and Apple sign-in send identity credentials to Firebase. We retain your verified email, including an Apple relay address when used, and user ID. We do not request contacts, Gmail or Drive. Password sign-in is handled by Firebase; Pagefond does not store a readable password. Firebase processes network addresses and user-agent information for authentication and abuse prevention. Anonymous AI trials also use a Firebase identifier.

Optional AI and content checks

With your confirmation, selected quotations, book attribution and creative directions are sent through OpenRouter to a model provider for artwork, recall cards or notebook organization. Private marginal notes are excluded from generation requests. AI input and output are checked for prohibited content. We request routes that prohibit provider data collection and require zero retention of prompt content. This routing restriction is not a promise that no intermediary logs or operational metadata exist.

OpenRouter and its selected providers process the submitted content. We disclose this transfer as sharing in Google Play rather than relying on an unverified service-provider exception. OpenRouter's own account logging controls have not been independently verified; do not submit sensitive personal information to AI tasks. Selected output remains in your Pagefond library until you delete it or your account.

Before a public story is published, its confirmation explains that the selected image, excerpt and image description are sent for an AI safety check. A reflection is included only if you deliberately add it to the shared image. Uncertain or unavailable checks withhold publication. In-app AI reports contain the creation ID, account ID, selected reason and review status; they exclude private notes.

Book lookup

Online lookup sends your title, author or ISBN query to Google Books or Open Library. Lookup URLs can appear in our hosting request logs, retained for up to 30 days. Catalogue-cover images are retrieved and checked before delivery through Pagefond. The safety provider receives the cover image, not your private book-page photograph. Approved cover bytes are cached for up to seven days; blocked results for up to one day. Unchecked covers are withheld. External catalogue sites you open have their own privacy policies.

Public stories and controls

A share sheet does not publish your library. A public link requires a separate preview and confirmation. Anyone with the link can view and copy the selected artwork, excerpt and attribution. Links expire after 7 or 30 days and can be revoked. Editing, protecting or deleting the source closes access too. Copies already saved by others cannot be recalled. Public pages request no search indexing and use generic social previews.

You can report a story and hide stories from its reader in your browser. Hiding stores an opaque publisher code locally, without revealing their identity. Reported stories are hidden while reviewed. A minimal ownership/revocation record prevents a closed link from being republished by a retry and is removed when its owner's account is deleted.

Metrics and service security

Usage sharing is off by default. If enabled, bounded action counts, durations and diagnostic counts are linked to your user ID; they exclude passages, notes and photos. Disabling usage sharing deletes those events. Hosting and authentication services separately process request metadata for operation and security. We do not use advertising trackers or sell personal data.

Vercel runtime logs have a 30-day retention window. Application abuse controls store rotating keyed digests and request counts, not raw addresses, with a one-day expiry. Firebase states that authentication IP logs are retained for a few weeks. HTTPS protects data in transit; cloud and AI processing is not end-to-end encrypted.

Retention and deletion

Your active cloud library remains until you delete records or your account. Account deletion removes the sign-in account, cloud library, generation records, private assets, public story links and optional events. A minimal account ID/deletion-date sentinel expires after 30 days to prevent stale requests from restoring the account. Daily maintenance removes expired records in bounded batches; expiry and physical deletion are not simultaneous.

Safety reports expire after 180 days; resolved story reports expire 90 days after review. Beta-access requests expire after 90 days. These separate queues also use daily maintenance. Support correspondence is used to resolve your request and document its handling; contact support to request its removal. Legal or unresolved security obligations may require the relevant minimum records to be retained.

The current Firestore project has no enabled point-in-time recovery or scheduled-backup configuration. Providers can still have internal recovery copies. Firebase states that deleted authentication data is removed from live and backup systems within 180 days. Vercel Blob deletion can take up to 60 seconds to propagate through its cache. Other provider security records and recovery copies follow their applicable retention/deletion terms; account deletion does not promise instant erasure of every provider-held copy.

Export what you need before deletion. Offline copies, exports and other people's saved copies are not remotely erased. Request account deletion without the app, or use Settings → Delete account and cloud data. Ownership must be verified; never email a password or verification code. Apple users can revoke authorization through the app's Apple confirmation. Cancel any active store subscription separately.

Payments and international processing

Store purchases are currently disabled. If enabled later, Apple or Google handles payment details; Pagefond does not receive your card number. Disclosures will be updated before changing that flow. Firebase, Vercel, OpenRouter and their providers may process data outside your country.

Beta access requests

The testing signup form collects email, phone platform and consent, plus reading interests/rhythm when supplied and the signup-page/campaign label. It does not collect passages. This information is used for testing invitations; contact support to withdraw consent.

Provider details: Firebase privacy, Vercel privacy, and OpenRouter privacy. Content standards · Support